> For the complete documentation index, see [llms.txt](https://riteshs4hu.gitbook.io/infosec-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://riteshs4hu.gitbook.io/infosec-notes/internal-and-external-network-sec/segmentation-testing.md).

# Segmentation Testing

Network Segmentation Testing is the process of validating that network segmentation controls are implemented and enforced as designed. The objective is to verify that communication between network segments, subnets, VLANs, or security zones is permitted only where explicitly authorized.

The objectives of Network Segmentation Testing are to:

* Verify that network segmentation policies are functioning as intended.
* Validate firewall rules, Access Control Lists (ACLs), and routing configurations.
* Confirm that unauthorized communication between network segments is blocked.
* Identify excessive network access that increases the attack surface.
* Ensure compliance with organizational security requirements and the principle of least privilege.

### Testing Methodology

Each source network is tested against one or more destination networks to determine whether communication is permitted or denied according to the approved network security policy.

For each test:

1. Identify the source host.
2. Identify the destination host or service.
3. Determine the expected communication based on the approved network design.
4. Test network connectivity.
5. Record whether the result matches the expected outcome.
6. Document any unexpected communication paths.

#### Commands

The following commands can be used to validate host reachability and identify accessible services during Network Segmentation Testing.

* Discovers live hosts using ARP requests.

```bash
nmap -v -PR -iL scope.txt -oA nmap-arp-scan
```

* Identifies hosts that respond to ICMP echo requests.

```
nmap -v -sn -iL scope.txt -oA nmap-ping-scan
```

* Verifies the target scope without sending any packets.

```
nmap -v -sL -iL scope.txt -oA nmap-list-scan
```

* Performs Nmap's default host discovery and common port scan.

```
nmap -v -iL scope.txt -oA nmap-default-scan
```

* Rapidly discovers open TCP ports on target hosts.

```
naabu -list scope.txt -o naabu-top-ports.txt
```